search

cyb3rfox / Aurora-Incident-Response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Apache License 2.0
742 stars 79 forks source link

Allow to change systems to empty again in the timeline #51

Closed febrezo closed 3 years ago

febrezo commented 3 years ago

Once an event is added to the timeline it is not possible to change the system affected to empty or None. This can happend when you notice that you tagged as a connection coming from a machine which is currently unknown (i. e., you thought it was a system but you realize with additional information that DHCP may be mixing things).

febrezo commented 3 years ago

I'm closing this since I realized that the Event System is thought to never be empty as once it is noted down it's because it is known. I have confirmed that I can do what I expected by changing the arrow and leaving empty the Remote System.